Latest Windows update removed ChilkatCrypt2.dll, breaking 1password - Critical Component Missing

GrumpyM

Hello,

I woke up this morning, and my PC was asking me to reboot to install critical updates. I accepted and rebooted, and upon reboot 1password would not start with an error saying a critical component was missing. Re-installing the application would also fail, saying the ChilkatCrypt2.dll file could not be found. When I went and looked for it in Windows/System32, it was not there.

I used System Restore to revert the update, and 1password works again with no error. I've checked, and the ChilkatCrypt2.dll is still not in Windows/System32 (??) but 1password is working correctly.

I am nervous about proceeding with Windows update at this time. Although it's possible this is a problem with just my machine, I wanted to post here in case others are having similar problems.

Nathan

mikeybyker

Hi - exactly the same here! Turned my computer on and as soon as it booted, 1Password prompt told me ChilkatCrypt2.dll was missing and to reinstall as admin (I hadn't even launched 1password or a browser). I tried this - and each time I get the same "ChilkatCrypt2.dll file could not be found" error and the installation aborts.
I've looked for the file, and in system backups (3rd party, not windows system restore) - it isn't in the specified path (C:\Windows\System32).

Strangely enough, searching a full-drive backup, there is the ChilkatCrypt2.dll file - but in C:\Windows\SysWOW64\ instead of the path 1password is looking in...

I don't have system restore points so can't roll back - and I can't install 1password due to this error...

Any help much appreciated!

Mike

trackley

Yes. Something like this just occurred also, but for me Avast started saying that it found the trojan in
ChilkatCrypt2.dll and suggested I do a boot up scan.

The boot up scan has identified the same Trojan (MSIL:Crypt-NB[Trj] in
ChilkatCrypt2.dll
ChilkatZip2.dll

and every 1password update that i have downloaded from
1password-1.0.9.299.exe
to
1password-1.0.9.327.exe
that were still present in my users..\appdata\local\temp folder.

I deleted all these "infections" even if it is a false alarm.

It's still scanning the rest of the drive. I assume that when i am back up and running, my 1password will be broke as well and require a full reinstall.

troy

JHW

The same Trojan infection was reported today by Avast on my two Windows machines with 1Password installed. It must have something to do with Avast's signature update 130507-0 which was installed shortly before the detection. I didn't receive any Windows updates today by the way...

GrumpyM

I am the OP above, and wanted to add that I am also running Avast. I didn't get any errors from Avast though, but it might be because it was on Silent/Gaming mode (whatever that means).

JHW

I uploaded my local Chilkatzip2.DLL as well as the 1password-1.0.9.327.exe from my temp folder at virustotal and received detections only from Avast and Gdata, which also uses the Avast engine. The other scanners didn't detect any malware. So it's almost certainly a false positive, but an official statement from the Agile Bits support would be highly appreciated.

JHW

This Avast false positive appears to affect other programs besides 1Password as well: forum.avast.com/index.php?topic=123386.0

MikeT

Hi guys,

We've notified Avast about this false positive, and they just confirmed it for us, they're working on fixing it as fast as they can. I don't know when they'll push the definition update to Avast to remove the file as infected but for now, you'll need to whitelist the file to let 1Password run. It is absolutely clean and not modified nor infected, it appears to be a mistake in the heuristics, which is why @JHW mentioned about other apps.

Any files that appears to be close to the same Chilkatzip2.dll, it'll be flagged as infected, even if it is not.

tdube

THANKS for update...

tdube

BTW - just got an avast update to the main program - asked for restart. - hopefully this gets fixed!

tdube

Restarted - still didnt work but then forced a definitions update ad got a rev-1 update.. Worked.

MikeT

Hi @tdube,

That's great, thanks for letting us know!

JHW

Same here, the problem has been fixed by the newest Avast software and definition updates. Thanks for the feedback!

(Things like these make me wish I had already completed my personal IT infrastructure's migration away from Windows though...)

khad

Great news! Thanks for confirming.

If we can be of further assistance, please let us know. We are always here to help!